Argus Authorization Service¶
Summary¶
The Argus Authorization Service renders consistent authorization decisions for distributed services (e.g., user interfaces, portals, computing elements, storage elements). The service is based on the XACML standard, and uses authorization policies to determine if a user is allowed or denied to perform a certain action on a particular service.
The Argus Authorization Service is composed of three main components:
- The Policy Administration Point (PAP) provides the tools to author authorization policies, organize them in the local repository and configure policy distribution among remote PAPs.
- The Policy Decision Point (PDP) implements the authorization engine, and is responsible for the evaluation of the authorization requests against the XACML policies retrieved from the PAP.
- The Policy Enforcement Point Server (PEP Server) ensures the integrity and consistency of the authorization requests received from the PEP clients. Lightweight PEP client libraries are also provided to ease the integration and interoperability with other EMI services or components.
The following graphic shows the interaction between the components of the service:
Note: In Argus, the PEP is separated in a client/server architecture. The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.
Argus Service Installation¶
The following section provides instructions for setting up an Argus environment quickly. It does not provide an exhaustive description of every possible deployment model or configuration option, that can be found in the following Service Components and Enabled Applications sections.
Before you continue it is recommend that you read this introduction to the Argus system. This will provide you with a better understanding of how the components work together, what information passes between the components and how policies are formed.
Argus Deployment¶
The Argus Service is installed with YUM. For the version 1.7, there isn’t an automatic configuration tool. Older version are configured with YAIM.
Please follow the Argus Deployment for version 1.7 documentation.
gLExec Worker Node with Argus Deployment¶
To install and configure an Argus compatible gLExec worker node, follow these GLExec Argus Quick Installation Guide
Service Components¶
If you are beginning to install the authorization service from scratch, you should install the components in the order listed here; PAP, then PDP, then PEPd. You don’t have to, but it makes the most sense for most use cases.
PAP: Policy Administration Point¶
The Policy Administration Point (PAP) provides three major functions:
- Provide the tools for authoring policies
- Store and manage authored policies
- Provide managed policies to other authorization service components
Installation | Configuration | Operation |
PDP: Policy Decision Point¶
The Policy Decision Point (PDP) is a policy evaluation engine. The PDP receives authorization requests from Policy Enforcement Points and evaluates these requests against authorization policies retrieved from the PAP.
Installation | Configuration | Operation | Troubleshooting |
PEP: Policy Enforcement Point¶
The Policy Enforcement Point (PEP) is the client to the authorization service. It gathers information relevant to an authorization request (e.g. who the user, what action they are attempting to perform, which service they are attempting to perform the action on, etc.) and sends the request to the PDP for evaluation. The PEP then acts upon returned result by allowing the request to proceed (in the case a positive authorization decision) or by denying the action (in the event of a negative decision).
In Argus, the PEP itself has a client/server architecture
- The PEP Server handles the lightweight PEP client requests, and runs on the Argus node.
- Lightweight PEP client libraries are available to authorize requests from the application side, and to enforce decision locally. There are two variants available:
- PEP Client C API: Programming Interface (API)
- PEP Client Java API: Programming Interface (API)
Installation | Configuration | Operation | Troubleshooting |
PEP command-line clients are also available
Enabled Applications¶
The following applications contain an Argus PEP client and can make authorization requests to the Argus service.
GSI PEP Callout | Introduction | Installation | Configuration | Troubleshooting |
---|---|---|---|---|
gLExec with PEP Plugin | Introduction | Installation | Configuration | Troubleshooting |
Support and Monitoring¶
GGUS Support¶
General support (installation, site administrator) for Argus is available through GGUS
Argus Support Mailing List¶
Argus specific (developer, site administrator) questions can be sent directly to the argus-support@googlegroups.com mailing list. You don’t need a Google email address or a Google account to send or receive emails from this mailing list.
- Subscription: To subscribe to the support mailing list, simply send an email to: argus-support+subscribe@googlegroups.com
- Unsubscribe: You can unsubscribe from the list at anytime by sending an email to: argus-support+unsubscribe@googlegroups.com
NOTE: The mailing list was previously argus-support@cern.ch, but it have been migrated to argus-support@googlegroups.com at the end of the EMI project (April 2013).
Nagios Monitoring¶
Nagios plugins are available to monitor an Argus server.
Development Information¶
Argus is an open-source product hosted on GitHub. In addition to this user-oriented documentation, you can find a description of Argus architecture and main components at Argus main site.
Specifications¶
- XACML 2.0 Specifications eXtensible Access Control Markup Language (XACML) Version 2.0
- SAML 2.0 Profile of XACML, Version 2 (Working Draft 5)
- XACML Profile for the gLite WN XACML Grid Worker Node Authorization Profile (v. 1.0)
- XACML Profile for the gLite CE XACML Grid Computing Element Authorization Profile (v. 1.0)
- XACML Authorization Profile for EMI Common XACML Authorization Profile (v. 1.1)
Requirements¶
- Requirements Document (EDMS document 944192)
- Testing Plan (EDMS document 986067)
Presentations¶
Argus - EMI Authorization Integration
(EMI AH 2011, 31 May 2011, Lund)Argus - EMI Authorization Service
(EGI UF 2011, 12 April 2011, Vilnus)Argus Security
(EGI TF 2010 Security Session, 17 Sept. 2010, Amsterdam)General introduction to the authorization service
Introduction to Argus for ROD
(EGI ROD Workshop, 2 June 2010, Amsterdam)
Souce Code Information¶
The Argus source code is on GitHub.
- Argus Authorization Service: https://github.com/argus-authz
Development Tools¶
The Argus PT uses the following development tools.
For performance and load testing we use the following testing suite.
Argus Production Settings and Optimization¶
Production sites can optimize the Argus Service settings to their specific needs. Please have a look at the Argus Service Fine Tuning documentation.
Perfomance and Load Testing¶
Argus provides a load testsuite, based on Grinder framework.
More information can be found on Argus load testsuite.
Additional Support¶
- HERAS-AF project has supported the project by providing a good XACML policy engine and excellent, ongoing, support of their code.
- YourKit is kindly supporting this open source projects with its full-featured Java Profiler. YourKit, LLC is the creator of innovative and intelligent tools for profiling Java and .NET applications. Take a look at YourKit’s leading software products: YourKit Java Profiler and YourKit .NET Profiler.
- This product includes software developed by the Caucho Technology.
About the name Argus¶
In Greek mythology Argus was a 100-eyed giant that was meant to watch and protect various things and people including the Goddess Io. He was slain by Hermes but the gods chose to preserve his hundred eyes and affix them to the tail-feathers of a brilliantly colored bird, the peacock, in homage. The peacock logo is provided by the royalty free clip art site clker.com.